env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
What does env do?
From the documentation, env runs programs in a modified environment.
env [OPTION]... [-] [NAME=VALUE]... [COMMAND [ARG]...]
It is clear that x is a name/variable and () { :;}; echo vulnerable' is the value for the variable.
Now, what is () { :;};?
When a function is exported, Bash stores its defenition as a value in the environment variable:
$ x() {echo hello world;}
$ export x
$ env | grep x
x=() {echo hello world};
Now, when x='() {:;}' means similar as writing
$ x() {:;}
$ export x
$ env | grep x
That is, we indirectly made export x onto the new environmnet created by the env. Here : is a null statement in Bash.
